From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 476114B04B7 for ; Mon, 10 Aug 2026 04:46:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786337212; cv=none; b=th0ATY70BTAqjTljyvwzI/GWWvRCitYOQcEefvyv+lqJFIbJ4xZk0GpxrPkuzipHga9MJi9oImB9gEEZXFTYrDb9tqNUIuETDshUVePDZgnViYlDddhgb5Ocxxi+LTidVrDhEh9IxarDv6IjbAAVu0C/c7Cetim/f8J1HjtMFqU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786337212; c=relaxed/simple; bh=7TYtCh1OijqP7wQ2jAai4YO8QYJtVEUUdFJzvzq55xA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=eaKEXeftjPWXDn/Pqrzm4Xfq6KN08tO4jGw3/Nr66cQS4qQX7rpx3ALLus/0KHCJ8EhFKgYA0WBjEgGAS+O/OYKhn7hzu1pjUBK8Kv3Ct2mWe3BwFA2ORnca3t+9NFdB/y+06AQjCjH0Z4PqQ8a5GetE7mpjOVE2n/6kMqsrWhA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=r5Gpf6BI; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="r5Gpf6BI" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4980fe6b3beso27136525e9.0 for ; Sun, 09 Aug 2026 21:46:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786337209; x=1786942009; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=8TZUt4ciTRDUzNpcx1pxQ+HCgcjACKU3sfdFPG8sBMg=; b=r5Gpf6BIWIfOQjusQ0TIqblOhPDFjyE29SnLwAJ8OE9i4oUKrmcuxt3eQXWGjsIMPX HjlLHyUnUWPBOPNOxWJoTH/0hfrdw8F1TNv/7iBgtgKHLcg5/fQd5wz/dlm5xJPfdNkK Ibn50Thjzn09ebiLJza/izq1Cj1Wcml+dRjGBAVTIZQ+T0ZZOMKDw6v2ZZEX2B1eA9oc jVC55NK7FmfSEAgXO1JNhsMtMAidi3pAocIsv5/woM1W9vLgO3imBHwGTRp7S1pUCmP5 EEy1iCYzWAVhmuuONKpvwkHqE1ESzy2cFwF1GaM4X7lUJM3yGyDd4LRUt7fX+/K0eaf6 8ZRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786337209; x=1786942009; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=8TZUt4ciTRDUzNpcx1pxQ+HCgcjACKU3sfdFPG8sBMg=; b=JOryqpYXk0KwkUXU6tuZkOx9D08SyvlvS3gAcWStcAQpWo2dHx2z3rfPGNIfO/QiSO ysF51Ta+p84/GjCM9CwqcfWM98yFyiaaklQP2GHWY0lp7EUHsXGe12/8Byy4Sq+Y2X2R C/131LfNGDJ9VjSwUuTxUFKECd3tytbbG+7a2NDTZlv7saRTDVLvRDzzxqccnonVHdDm sznb6lJ5OmTpcApinuOiVdH/oqH07Zol+hsC0r5rU/MRL31hfOwRSLggrgMWykJ7W5hP l1RYVfkI4wt7iluxR9VrEQR8wcJi1Y7QyN9PtU0HUP+hXpR0cfZSDPqRxSYw2EQLDu0P nh7A== X-Forwarded-Encrypted: i=1; AHgh+Rr4fXRIEAdjRtk3FTpc2VY5zZ2zoCnVCulF+06e2NeQQsjnzuGzpjB8mxnoCy6kYqrLMqsw0XLWCn7TDvI=@vger.kernel.org X-Gm-Message-State: AOJu0YxcK4CdywKaC7G0NnAbTipUQqb8GFjuQYircT9VGLiI1E0KbA6H DJodDtbvyHNAY+HNXeA9gWmlAtizt8szKpAtSYH6sf2IpVJCFRNGQjk= X-Gm-Gg: AR+sD117VH2iJTPfCRR5B2UhKN1nT2oOQuxpweSIsfl1LpIsP/a42oUUyytdm6j+XmG srDVmxYK8jqL1IdOgFgJl020lyWPBaXfc8V2R6jRQ88dY+3+aZTYDOhNyLUXakWhYyC5sYu7qLx QE22yfZ59NRFZjgqLIXy+CkqZFcqzsnEnaFQl6Wb7GIvfvAsG93NecbreXFY47UHICJQrns0Ieo crmMBVKsy6kfitmIhFW7kZsYxq1otafJbFkhAwvaibFU6xSjhMpl0LK9CWg/dt/i4tn1vY8Y0kk 11KPMrUW4nuuHOZONWqc451bbneKuJncxKX1sPBAw8YTi/q/YKLFrId9Fo7lE4v8C2BCZ3cUAeN iZ4AjZYMY+p9sXiyr4v8ejGxsD9P/rpwfVIJs/MrWCA7/uf00AWratzlR57i6hqNs/Js1vqsIvL WwePq7qpucKm0po6JxMIuG0FNip5tCEPvtfvxPeCMSSYuG3wba5Phu23naiFyZ8eYEgRsp2VOoG hMdatUXqZaowpdUzCB44w/HgEn9SKKo X-Received: by 2002:a05:600c:c87:b0:493:f783:c46a with SMTP id 5b1f17b1804b1-49962472d69mr146678615e9.6.1786337209431; Sun, 09 Aug 2026 21:46:49 -0700 (PDT) Received: from p183 (dynamic-vpdn-brest-46-53-134-188.brest.telecom.by. [46.53.134.188]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4995420cb4esm371994065e9.2.2026.08.09.21.46.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Aug 2026 21:46:48 -0700 (PDT) Date: Mon, 10 Aug 2026 07:50:32 +0300 From: Alexey Dobriyan To: Bradley Morgan Cc: akpm@linux-foundation.org, gorcunov@openvz.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator Message-ID: <70ff6317-fea5-4f57-835f-007169ba5ffc@p183> References: <20260809002901.32591-1-include@grrlz.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20260809002901.32591-1-include@grrlz.net> On Sun, Aug 09, 2026 at 12:29:01AM +0000, Bradley Morgan wrote: > prctl_set_auxv() copies the user vector into a stack buffer, forces > AT_NULL on the last two entries there, and then copies only len bytes > into mm->saved_auxv. Which is fine until the vector is shorter than > the buffer, because then the forced terminator sits past the end of > the copy and never lands in saved_auxv at all. > --- a/kernel/sys.c > +++ b/kernel/sys.c > @@ -2189,7 +2189,7 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr, > BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv)); > > task_lock(current); > - memcpy(mm->saved_auxv, user_auxv, len); > + memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv)); > task_unlock(current); You're supposed to use prctl(PR_SET_MM_AUXV) with correct "len", yes. This is userspace visible, warning could be added for another 14 years and then line changed. PR_ALEXEY